Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail's encrypted email is now available to all

engadget.com

Post reply on HN
Print view View original

51–60 of 111 posts

Re: ProtonMail's encrypted email is now available to all

#51

Post by suprgeek »

nickpsecurity wrote: post #44
suprgeek wrote: post #40

Earlier quoted context omitted.

Is there a "better" free alternative webmail?

You should consider all of them insecure and big time snoops if free and/or webmail. If webmail, best you can do is use a paid service with antisnooping in terms of service and preferrably local laws. Just reduces number that will attack you. Anything further requires using something like PGP/GPG over that so they can't read it. Strong endpoint security, too.

Thanks for taking the time to reply. Non-webmail may not be accessible from everywhere, paid-email entails money exchange which maybe traceable. Lavabit seems to have been secure enough for Snowden (for a while).

So the question remains: Yes Free and/or Webmail are bad - which one is the LEAST bad from a privacy & security perspective?

Re: ProtonMail's encrypted email is now available to all

#53

Post by buu700 »

tptacek wrote: post #47
eganist wrote: post #39

Earlier quoted context omitted.

Hah. I had some time to think about that interaction and concluded (after a chat with a few peers at AppSec Cali) that he and I simply differ in mentality. I understand where he's coming from about the risks posed by that level of flexibility in the execution environment, but I'm also more prone to push for the idea that making encryption more convenient for all justifies taking some risks in terms of the execution e…

You guys seem to remember more about "this interaction" than I do. Someone want to bring me up to speed?

There was a thread a couple months back where I brought up WebSign (Cyph's TOFU in-browser code signing layer) in response to a story about MEGAChat, which you generally disapproved of but didn't go into detail on why. There was also some related back-and-forth between you and eganist.

My impression was that you hadn't necessarily had the chance to fully digest the architecture due to time constraints on your end, and were coming more from a position of "the premise of this is scary and it's almost definitely broken in some way" than of having identified a specific flaw. Also, as eganist noted here, you may have held a different opinion than us on the drawbacks of the flexible execution environment (despite Cyph's partial mitigations of TypeScript for static typing and asm.js for pseudo-native crypto) vs the benefits of the well-vetted sandbox.

Re: ProtonMail's encrypted email is now available to all

#54

Post by tptacek »

buu700 wrote: post #53
tptacek wrote: post #47

Earlier quoted context omitted.

You guys seem to remember more about "this interaction" than I do. Someone want to bring me up to speed?

There was a thread a couple months back where I brought up WebSign (Cyph's TOFU in-browser code signing layer) in response to a story about MEGAChat, which you generally disapproved of but didn't go into detail on why. There was also some related back-and-forth between you and eganist. My impression was that you hadn't necessarily had the chance to fully digest the architecture due to time constraints on your end, an…

Oh wow, is Cyph the one with the elaborate caching scheme where they invalidate the certificate once a week to prevent the package, once downloaded, from ever reloading itself off the website?

Re: ProtonMail's encrypted email is now available to all

#55

Post by buu700 »

tptacek wrote: post #54
buu700 wrote: post #53

Earlier quoted context omitted.

There was a thread a couple months back where I brought up WebSign (Cyph's TOFU in-browser code signing layer) in response to a story about MEGAChat, which you generally disapproved of but didn't go into detail on why. There was also some related back-and-forth between you and eganist. My impression was that you hadn't necessarily had the chance to fully digest the architecture due to time constraints on your end, an…

Oh wow, is Cyph the one with the elaborate caching scheme where they invalidate the certificate once a week to prevent the package, once downloaded, from ever reloading itself off the website?

Yep, that's it. (To clarify, the signed package is freshly downloaded each time; it's just the root of the origin of the application that's pinned via "HPKP suicide" invalidation.)

Re: ProtonMail's encrypted email is now available to all

#56

Post by tptacek »

modernerd wrote: post #36
denova wrote: post #33

If you care enough about privacy to sign up for protonmail, why not just learn how to use pgp? It's not perfect, but it works. And... oh goodness, I'm looking at this [support page][1]; If you send encrypted mail to non-protonmail addresses, the recipients have to open the message in a web browser and enter in a password to read it. So instead of exchanging public keys, you have to send them a password, probably over…

Even Phil Zimmermann, PGP's creator, says it's too hard to use: “I hardly ever run PGP. When people send me PGP encrypted mail I have to go through a lot of trouble to decrypt it. If it’s coming from a stranger, I’ll say please re-send this in plain text, which probably raises their eyebrows.“ http://www.forbes.com/sites/parmyolson/2013/08/09/e-mails-bi... I tried the ProtonMail password protection feature today (whi…

"PGP is hard to use" is more memetic than accurate. What makes PGP hard is that it has a million options, and its vocal users (and detractors) seem insistent on availing themselves of as many of them as possible.

In reality, 80% of PGP's value (which is more value than you'll get out of any webmail system), you can get with three command lines:

    gpg -sear recipient@addr document.txt
Encrypt and sign a document, ASCII armored for inclusion in a 7-bit email, to a specific person or persons

    gpg -a --export my@addr
Dump your public key for out-of-band transmission to the peer you're exchanging messages with

    gpg document.txt.asc
Decrypt a message sent to you by someone else.

No keyservers. No subkeys. No crazy formatting. No exotic key types. Send a message to someone, read a message back from them.

You don't get forward secrecy (unless you manually rotate keys). You don't get peer validation unless you do it manually. You don't get real time chat. You can't encrypt a videoconference. On the other hand: you won't be the subject of someone's amusing blog post a year from now, either, because PGP used this way has been reliable for something like 15 years running.

Everyone I know who actually uses PGP, like for real, more than a couple times a year, uses it pretty much this way.

Re: ProtonMail's encrypted email is now available to all

#57

Post by tptacek »

buu700 wrote: post #55
tptacek wrote: post #54

Earlier quoted context omitted.

Oh wow, is Cyph the one with the elaborate caching scheme where they invalidate the certificate once a week to prevent the package, once downloaded, from ever reloading itself off the website?

Yep, that's it. (To clarify, the signed package is freshly downloaded each time; it's just the root of the origin of the application that's pinned via "HPKP suicide" invalidation.)

Look, it's clever. I mean it. I'm not saying the people that came up with that insane scheme were dumb to do that. It would be a good research project!

But I can't imagine relying on that janky set of side effects for my own personal safety, and I can't recommend that anyone else do that either.

If you want to use continuity (aka 'TOFU') for security and you insist on getting your crypto in the form of a browser Javascript application --- which is a bad idea for other reasons that I hope will become clearer later this year --- then you should just use an installable, non-auto-updatable Chrome application. People shouldn't play games with message crypto.

I really don't think doing message crypto in browser Javascript is going to work out. Or, if it does, it will work out only after 5-10 year of semiregular hair-on-fire security emergencies that the world's most repressive governments will tend to know about a year or two before the rest of us do.

Re: ProtonMail's encrypted email is now available to all

#59

Post by buu700 »

tptacek wrote: post #57
buu700 wrote: post #55

Earlier quoted context omitted.

Yep, that's it. (To clarify, the signed package is freshly downloaded each time; it's just the root of the origin of the application that's pinned via "HPKP suicide" invalidation.)

Look, it's clever. I mean it. I'm not saying the people that came up with that insane scheme were dumb to do that. It would be a good research project! But I can't imagine relying on that janky set of side effects for my own personal safety, and I can't recommend that anyone else do that either. If you want to use continuity (aka 'TOFU') for security and you insist on getting your crypto in the form of a browser Java…

Fair enough! I'm comfortable with it in terms of security given that HPKP is at least a security feature that makes certain guarantees, but I fully acknowledge that:

1. A future update to browser implementations and/or Web standards could hypothetically break this in terms of availability, DoSing/bricking Cyph for all of our users; and

2. If the server were to violate users' trust by not actually deleting the old TLS private keys, it wouldn't be as outwardly apparent as if it had instead needed to serve malicious code to the client, which is at least a little gross.

Ultimately, I think the value of this is in making sure that initial user onboarding is as smooth and easy as possible (without being totally insecure), with the next step on our end being to offer an optional browser extension to fortify the scheme in a less experimental manner.

which is a bad idea for other reasons that I hope will become clearer later this year

Well, that sounds rather ominous... Are you referring to something specific, and if so is it something you would be at liberty to share (either here publicly or out of band)?

Re: ProtonMail's encrypted email is now available to all

#60

Post by eganist »

tptacek wrote: post #57
buu700 wrote: post #55

Earlier quoted context omitted.

Yep, that's it. (To clarify, the signed package is freshly downloaded each time; it's just the root of the origin of the application that's pinned via "HPKP suicide" invalidation.)

Look, it's clever. I mean it. I'm not saying the people that came up with that insane scheme were dumb to do that. It would be a good research project! But I can't imagine relying on that janky set of side effects for my own personal safety, and I can't recommend that anyone else do that either. If you want to use continuity (aka 'TOFU') for security and you insist on getting your crypto in the form of a browser Java…

> which is a bad idea for other reasons that I hope will become clearer later this year

You're speaking with two people involved with the project, so if you're able/comfortable with talking in more depth about it, my PGP ID: 0x4D4C724C4BFB3E3F

Post reply on HN